Weekly Vulnerabilities Reports > February 7 to 13, 2005

Overview

41 new vulnerabilities reported during this period, including 9 critical vulnerabilities and 10 high severity vulnerabilities. This weekly summary report vulnerabilities in 91 products from 51 vendors including Gentoo, Redhat, Suse, GNU, and Microsoft. Vulnerabilities are notably categorized as "Out-of-bounds Write", "Incorrect Calculation of Buffer Size", and "Link Following".

  • 24 reported vulnerabilities are remotely exploitables.
  • 40 reported vulnerabilities are exploitable by an anonymous user.
  • Gentoo has the most reported vulnerabilities, with 7 reported vulnerabilities.
  • Debian has the most reported critical vulnerabilities, with 3 reported vulnerabilities.

TOTAL
VULNERABILITIES
CRITICAL RISK
VULNERABILITIES
HIGH RISK
VULNERABILITIES
MEDIUM RISK
VULNERABILITIES
LOW RISK
VULNERABILITIES
REMOTELY
EXPLOITABLE
LOCALLY
EXPLOITABLE
EXPLOIT
AVAILABLE
EXPLOITABLE
ANONYMOUSLY
AFFECTING
WEB APPLICATION

Vulnerability Details

The following table list reported vulnerabilities for the period covered by this report:

Expand/Hide

9 Critical Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2005-02-09 CVE-2004-0982 Mpg123 Remote URL Open Buffer Overflow vulnerability in Mpg123 0.59R/Pre0.59S

Buffer overflow in the getauthfromURL function in httpget.c in mpg123 pre0.59s and mpg123 0.59r could allow remote attackers or local users to execute arbitrary code via an mp3 file that contains a long string before the @ (at sign) in a URL.

10.0
2005-02-09 CVE-2004-0981 Imagemagick
Debian
Gentoo
Suse
Buffer overflow in the EXIF parsing routine in ImageMagick before 6.1.0 allows remote attackers to execute arbitrary code via a certain image file.
10.0
2005-02-09 CVE-2004-0980 Angus Mackay
Debian
Gentoo
Remote Format String vulnerability in EZ-IPupdate

Format string vulnerability in ez-ipupdate.c for ez-ipupdate 3.0.10 through 3.0.11b8, when running in daemon mode with certain service types in use, allows remote servers to execute arbitrary code.

10.0
2005-02-09 CVE-2004-0978 Microsoft Out-Of-Bounds Write vulnerability in Microsoft Internet Explorer 5.01/5.5/6

Heap-based buffer overflow in the Hrtbeat.ocx (Heartbeat) ActiveX control for Internet Explorer 5.01 through 6, when users who visit online gaming sites that are associated with MSN, allows remote attackers to execute arbitrary code via the SetupData parameter.

10.0
2005-02-09 CVE-2004-0964 Zinf
Debian
Remote Buffer Overflow vulnerability in Zinf Malformed Playlist File

Buffer overflow in Zinf 2.2.1 on Windows, and other older versions for Linux, allows remote attackers or local users to execute arbitrary code via certain values in a .pls file.

10.0
2005-02-09 CVE-2004-0963 Microsoft Unspecified vulnerability in Microsoft Word 2002

Buffer overflow in Microsoft Word 2002 (10.6612.6714) SP3, and possibly other versions, allows remote attackers to cause a denial of service (application exception) and possibly execute arbitrary code in winword.exe via certain unexpected values in a .doc file, including (1) an offset that triggers an out-of-bounds memory access, (2) a certain value that causes a large memory copy as triggered by an integer conversion error, and other values.

10.0
2005-02-09 CVE-2004-0962 Apple Unspecified vulnerability in Apple Remote Desktop 2.0.0

Apple Remote Desktop Client 1.2.4 executes a GUI application as root when it is started by an Apple Remote Desktop Administrator application, which allows remote authenticated users to execute arbitrary code when loginwindow is active via Fast User Switching.

10.0
2005-02-09 CVE-2004-0947 ARJ Software INC
Gentoo
Suse
Remote Buffer Overflow vulnerability in ARJ Software UNARJ

Buffer overflow in unarj before 2.63a-r2 allows remote attackers to execute arbitrary code via an arj archive that contains long filenames.

10.0
2005-02-09 CVE-2004-0941 GD Graphics Library
Trustix
Remote Buffer overflow vulnerability in GD Graphics Library

Multiple buffer overflows in the gd graphics library (libgd) 2.0.21 and earlier may allow remote attackers to execute arbitrary code via malformed image files that trigger the overflows due to improper calls to the gdMalloc function, a different set of vulnerabilities than CVE-2004-0990.

10.0

10 High Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2005-02-09 CVE-2004-0940 Openpkg
Apache
Slackware
HP
Suse
Trustix
Incorrect Calculation of Buffer Size vulnerability in multiple products

Buffer overflow in the get_tag function in mod_include for Apache 1.3.x to 1.3.32 allows local users who can create SSI documents to execute arbitrary code as the apache user via SSI (XSSI) documents that trigger a length calculation error.

7.8
2005-02-09 CVE-2004-0937 Archive ZIP
Broadcom
CA
Eset Software
Kaspersky LAB
Mcafee
RAV Antivirus
Sophos
Gentoo
Mandrakesoft
Suse
Sophos Anti-Virus before 3.87.0, and Sophos Anti-Virus for Windows 95, 98, and Me before 3.88.0, allows remote attackers to bypass antivirus protection via a compressed file with both local and global headers set to zero, which does not prevent the compressed file from being opened on a target system.
7.5
2005-02-08 CVE-2005-0249 Symantec Unspecified vulnerability in Symantec products

Heap-based buffer overflow in the DEC2EXE module for Symantec AntiVirus Library allows remote attackers to execute arbitrary code via a UPX compressed file containing a negative virtual offset to a crafted PE header.

7.5
2005-02-08 CVE-2005-0233 Mozilla
Omnigroup
Opera
Opera Software
The International Domain Name (IDN) support in Firefox 1.0, Camino .8.5, and Mozilla before 1.7.6 allows remote attackers to spoof domain names using punycode encoded domain names that are decoded in URLs and SSL certificates in a way that uses homograph characters from other character sets, which facilitates phishing attacks.
7.5
2005-02-08 CVE-2004-0848 Microsoft Unspecified vulnerability in Microsoft products

Buffer overflow in Microsoft Office XP allows remote attackers to execute arbitrary code via a link with a URL file location containing long inputs after (1) "%00 (null byte) in .doc filenames or (2) "%0a" (carriage return) in .rtf filenames.

7.5
2005-02-07 CVE-2005-0100 GNU Remote Format String vulnerability in GNU Emacs and Xemacs

Format string vulnerability in the movemail utility in (1) Emacs 20.x, 21.3, and possibly other versions, and (2) XEmacs 21.4 and earlier, allows remote malicious POP3 servers to execute arbitrary code via crafted packets.

7.5
2005-02-11 CVE-2005-0074 Xpcd Local Buffer Overflow vulnerability in Xpcd 2.08

Buffer overflow in pcdsvgaview in xpcd 2.08 allows local users to execute arbitrary code.

7.2
2005-02-09 CVE-2004-0967 Aladdin Enterprises Link Following vulnerability in Aladdin Enterprises Ghostscript

The (1) pj-gs.sh, (2) ps2epsi, (3) pv.sh, and (4) sysvlp.sh scripts in the ESP Ghostscript (espgs) package in Trustix Secure Linux 1.5 through 2.1, and other operating systems, allow local users to overwrite files via a symlink attack on temporary files.

7.2
2005-02-09 CVE-2004-0965 HP Local Privilege Escalation vulnerability in HP-UX STMKFONT

stmkfont in HP-UX B.11.00 through B.11.23 relies on the user-specified PATH when executing certain commands, which allows local users to execute arbitrary code by modifying the PATH environment variable to point to malicious programs.

7.2
2005-02-07 CVE-2004-1131 SCO Local Buffer Overflow vulnerability in SCO OpenServer Enable And Disable

Multiple buffer overflows in the enable command for SCO OpenServer 5.0.6 and 5.0.7 allow local users to execute arbitrary code via long command line arguments.

7.2

11 Medium Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2005-02-09 CVE-2004-0957 Openpkg
Oracle
Redhat
Suse
Trustix
Ubuntu
Unknown vulnerability in MySQL 3.23.58 and earlier, when a local user has privileges for a database whose name includes a "_" (underscore), grants privileges to other databases that have similar names, which can allow the user to conduct unauthorized activities.
6.8
2005-02-12 CVE-2005-0430 ID Software Remote Denial of Service vulnerability in ID Software Quake 3 Engine Infostring Query

The Quake 3 engine, as used in multiple game packages, allows remote attackers to cause a denial of service (shutdown game server) and possibly crash the server via a long infostring, possibly triggering a buffer overflow.

5.0
2005-02-10 CVE-2005-0364 HP Denial-Of-Service vulnerability in HP Hp-Ux 11.00/11.11/11.23

Unknown vulnerability in BIND 9.2.0 in HP-UX B.11.00, B.11.11, and B.11.23 allows remote attackers to cause a denial of service.

5.0
2005-02-09 CVE-2004-0961 Freeradius
Redhat
Attribute Decoding Denial Of Service vulnerability in FreeRADIUS

Memory leak in FreeRADIUS before 1.0.1 allows remote attackers to cause a denial of service (memory exhaustion) via a series of Access-Request packets with (1) Ascend-Send-Secret, (2) Ascend-Recv-Secret, or (3) Tunnel-Password attributes.

5.0
2005-02-09 CVE-2004-0960 Freeradius
Redhat
Attribute Decoding Denial Of Service vulnerability in FreeRADIUS

FreeRADIUS before 1.0.1 allows remote attackers to cause a denial of service (core dump) via malformed USR vendor-specific attributes (VSA) that cause a memcpy operation with a -1 argument.

5.0
2005-02-09 CVE-2004-0950 Danware Data Information Disclosure vulnerability in Danware NetOp Remote Control

NetOp Host before 7.65 build 2004278 allows remote attackers to obtain sensitive hostname, username and local IP address information via (1) a NetOp HELO request, or (2) when responses are disabled, a "custom" HELO request.

5.0
2005-02-09 CVE-2004-0939 Neoteris Denial-Of-Service vulnerability in Instant Virtual Extranet

changepassword.cgi in Neoteris Instant Virtual Extranet (IVE) 3.x and 4.x, with LDAP authentication or NT domain authentication enabled, does not limit the number of times a bad password can be entered, which allows remote attackers to guess passwords via a brute force attack.

5.0
2005-02-07 CVE-2005-0175 Squid Unspecified vulnerability in Squid

Squid 2.5 up to 2.5.STABLE7 allows remote attackers to poison the cache via an HTTP response splitting attack.

5.0
2005-02-07 CVE-2005-0174 Squid Remote vulnerability in Squid Proxy Oversize HTTP Headers

Squid 2.5 up to 2.5.STABLE7 allows remote attackers to poison the cache or conduct certain attacks via headers that do not follow the HTTP specification, including (1) multiple Content-Length headers, (2) carriage return (CR) characters that are not part of a CRLF pair, and (3) header names containing whitespace characters.

5.0
2005-02-09 CVE-2005-0367 Argosoft File-Upload vulnerability in Argosoft Mail Server 1.8.7.3

Multiple directory traversal vulnerabilities in ArGoSoft Mail Server 1.8.7.3 allow remote authenticated users to read, delete, or upload arbitrary files via a ..

4.6
2005-02-09 CVE-2005-0362 Awstats Local Security vulnerability in AWStats

awstats.pl in AWStats 6.2 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) "pluginmode", (2) "loadplugin", or (3) "noloadplugin" parameters.

4.6

11 Low Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2005-02-07 CVE-2005-0231 Mozilla Unspecified vulnerability in Mozilla Firefox 1.0

Firefox 1.0 does not invoke the Javascript Security Manager when a user drags a javascript: or data: URL to a tab, which allows remote attackers to bypass the security model, aka "firetabbing."

2.6
2005-02-11 CVE-2005-0114 Checkpoint
Zonelabs
Local Denial of Service vulnerability in Zone Labs ZoneAlarm

vsdatant.sys in Zone Lab ZoneAlarm before 5.5.062.011, ZoneAlarm Wireless before 5.5.080.000, Check Point Integrity Client 4.x before 4.5.122.000 and 5.x before 5.1.556.166 do not properly verify that the ServerPortName argument to the NtConnectPort function is a valid memory address, which allows local users to cause a denial of service (system crash) when ZoneAlarm attempts to dereference an invalid pointer.

2.1
2005-02-10 CVE-2005-0261 IBM Local File Disclosure vulnerability in IBM AIX LSPath Unauthorized

lspath in AIX 5.2, 5.3, and possibly earlier versions, does not drop privileges before processing the -f option, which allows local users to read one line of arbitrary files.

2.1
2005-02-09 CVE-2004-0976 Larry Wall Insecure Temporary File Creation vulnerability in Perl

Multiple scripts in the perl package in Trustix Secure Linux 1.5 through 2.1 and other operating systems allows local users to overwrite files via a symlink attack on temporary files.

2.1
2005-02-09 CVE-2004-0975 Mandrakesoft
Openssl
Gentoo
The der_chop script in the openssl package in Trustix Secure Linux 1.5 through 2.1 and other operating systems allows local users to overwrite files via a symlink attack on temporary files.
2.1
2005-02-09 CVE-2004-0974 Netatalk
Mandrakesoft
Redhat
The netatalk package in Trustix Secure Linux 1.5 through 2.1, and possibly other operating systems, allows local users to overwrite files via a symlink attack on temporary files.
2.1
2005-02-09 CVE-2004-0972 LVM
Gentoo
Insecure Temporary File Creation vulnerability in Trustix LVM Utilities

The lvmcreate_initrd script in the lvm package in Trustix Secure Linux 1.5 through 2.1, and possibly other operating systems, allows local users to overwrite files via a symlink attack on temporary files.

2.1
2005-02-09 CVE-2004-0970 GNU Insecure Temporary File Creation vulnerability in GNU Gzip 1.2.4A

The (1) gzexe, (2) zdiff, and (3) znew scripts in the gzip package, as used by other packages such as ncompress, allows local users to overwrite files via a symlink attack on temporary files.

2.1
2005-02-09 CVE-2004-0969 GNU
Gentoo
Ubuntu
The groffer script in the Groff package 1.18 and later versions, as used in Trustix Secure Linux 1.5 through 2.1, and possibly other operating systems, allows local users to overwrite files via a symlink attack on temporary files.
2.1
2005-02-09 CVE-2004-0968 GNU
Redhat
The catchsegv script in glibc 2.3.2 and earlier allows local users to overwrite files via a symlink attack on temporary files.
2.1
2005-02-09 CVE-2004-0966 GNU
Ubuntu
Insecure Temporary File Creation vulnerability in GNU GetText

The (1) autopoint and (2) gettextize scripts in the GNU gettext package 1.14 and later versions, as used in Trustix Secure Linux 1.5 through 2.1 and other operating systems, allows local users to overwrite files via a symlink attack on temporary files.

2.1